GitHub Advisoryadvisory · npm
GHSA-4w62-cq5r-5mmq express-cart unrestricted file upload vulnerability
HIGH
Official page ↗
- Aliases
- CVE-2018-3758
- Ecosystem
- npm
- Packages
- express-cart
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-434
- Reviewed
- 2024-04-01
Affected packages
• npm express-cart: < 1.1.7 → fixed in 1.1.7
Description
Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine.
Related
Alias · CVE (1)
- CVE-2018-3758 Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine. vulnerability
Weakness · CWE (1)
- CWE-434 Unrestricted Upload of File with Dangerous Type weakness